chore: replace container base images with pixi-managed environments

Author: chaen

.github/workflows/deployment.yml

@@ -97,7 +97,7 @@ jobs:
 
   docker:
     needs: deploy-pypi
-    timeout-minutes:  30
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -112,58 +112,46 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Download diracx wheels
-        uses: actions/download-artifact@v8
-        with:
-            name: diracx-whl
-      - name: "Find wheels"
-        id: find_wheel
-        run: |
-          # We need to copy them there to be able to access them in the RUN --mount
-          cp diracx*.whl containers/client/
-          cp diracx*.whl containers/services/
-          for wheel_fn in *.whl; do
-            pkg_name=$(basename "${wheel_fn}" | cut -d '-' -f 1)
-            echo "${pkg_name}-wheel-name=$(ls "${pkg_name}"-*.whl)" >> $GITHUB_OUTPUT
-          done
 
-      - name: Build and push client (release)
+      - name: Build and push services (release)
         uses: docker/build-push-action@v7
         if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }}
         with:
-          context: containers/client/
-          push: ${{ needs.deploy-pypi.outputs.create-release == 'true' }}
-          tags: "ghcr.io/diracgrid/diracx/client:${{ needs.deploy-pypi.outputs.new-version }}"
+          context: .
+          file: containers/Dockerfile
+          build-args: PIXI_ENV=container-services
+          push: true
+          tags: "ghcr.io/diracgrid/diracx/services:${{ needs.deploy-pypi.outputs.new-version }}"
           platforms: linux/amd64,linux/arm64
-          build-args: EXTRA_PACKAGES_TO_INSTALL=DIRACCommon~=9.0.0
-      - name: Build and push services (release)
+      - name: Build and push client (release)
         uses: docker/build-push-action@v7
         if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }}
         with:
-          context: containers/services/
-          push: ${{ needs.deploy-pypi.outputs.create-release == 'true' }}
-          tags: "ghcr.io/diracgrid/diracx/services:${{ needs.deploy-pypi.outputs.new-version }}"
+          context: .
+          file: containers/Dockerfile
+          build-args: PIXI_ENV=container-client
+          push: true
+          tags: "ghcr.io/diracgrid/diracx/client:${{ needs.deploy-pypi.outputs.new-version }}"
           platforms: linux/amd64,linux/arm64
-          build-args: EXTRA_PACKAGES_TO_INSTALL=DIRACCommon~=9.0.0
 
-      - name: Build and push client (dev)
+      - name: Build and push services (dev)
         uses: docker/build-push-action@v7
         with:
-          context: containers/client/
+          context: .
+          file: containers/Dockerfile
+          build-args: PIXI_ENV=container-services
           push: ${{ github.event_name != 'pull_request' && github.repository == 'DIRACGrid/diracx' && github.ref_name == 'main' }}
-          tags: ghcr.io/diracgrid/diracx/client:dev
+          tags: ghcr.io/diracgrid/diracx/services:dev
           platforms: linux/amd64,linux/arm64
-          build-args: |
-            EXTRA_PACKAGES_TO_INSTALL=git+https://github.com/DIRACGrid/DIRAC.git@integration#egg=diraccommon\&subdirectory=dirac-common
-      - name: Build and push services (dev)
+      - name: Build and push client (dev)
         uses: docker/build-push-action@v7
         with:
-          context: containers/services/
+          context: .
+          file: containers/Dockerfile
+          build-args: PIXI_ENV=container-client
           push: ${{ github.event_name != 'pull_request' && github.repository == 'DIRACGrid/diracx' && github.ref_name == 'main' }}
-          tags: ghcr.io/diracgrid/diracx/services:dev
+          tags: ghcr.io/diracgrid/diracx/client:dev
           platforms: linux/amd64,linux/arm64
-          build-args: |
-            EXTRA_PACKAGES_TO_INSTALL=git+https://github.com/DIRACGrid/DIRAC.git@integration#egg=diraccommon\&subdirectory=dirac-common
 
   update-charts:
     name: Update Helm charts

.github/workflows/main.yml

@@ -121,38 +121,20 @@ jobs:
         with:
           cache: false
           environments: ${{ matrix.extension == 'diracx' && 'default' || 'default-gubbins' }}
-      - name: Build gubbins wheels
-        if: ${{ matrix.extension == 'gubbins' }}
-        run: |
-          for pkg_dir in $PWD/diracx-*; do
-            echo "Building $pkg_dir"
-            pixi exec python-build --outdir $PWD/extensions/containers/services/ $pkg_dir
-          done
-          # Also build the diracx metapackage
-          pixi exec python-build --outdir $PWD/extensions/containers/services/ .
-          # And build the gubbins package
-          for pkg_dir in $PWD/extensions/gubbins/gubbins-*; do
-            # Skip the testing package
-            if [[ "${pkg_dir}" =~ .*testing.* ]];
-            then
-              echo "Do not build ${pkg_dir}";
-              continue;
-            fi
-            echo "Building $pkg_dir"
-            pixi exec python-build --outdir $PWD/extensions/containers/services/ $pkg_dir
-          done
       - name: Set up Docker Buildx
         if: ${{ matrix.extension == 'gubbins' }}
         uses: docker/setup-buildx-action@v4
       - name: Build container for gubbins
         if: ${{ matrix.extension == 'gubbins' }}
         uses: docker/build-push-action@v7
         with:
-          context: extensions/containers/services
+          context: .
+          file: containers/Dockerfile
+          build-args: |
+            PIXI_ENV=gubbins-container-services
+            DIRACX_EXTENSIONS=gubbins,diracx
           tags: gubbins/services:dev
           outputs: type=docker,dest=/tmp/gubbins_services_image.tar
-          build-args: |
-            EXTENSION_CUSTOM_SOURCES_TO_INSTALL=/bindmount/gubbins_db*.whl,/bindmount/gubbins_logic*.whl,/bindmount/gubbins_routers*.whl,/bindmount/gubbins_client*.whl
       - name: Load image
         if: ${{ matrix.extension == 'gubbins' }}
         run: |

.gitignore

@@ -97,7 +97,6 @@ docs/source/_build
 
 # pixi environments
 .pixi
-pixi.lock
 *.egg-info
 docs/templates/_builtin_markdown.jinja
 
@@ -106,3 +105,7 @@ docs/templates/_builtin_markdown.jinja
 
 # docs site
 site
+
+# DiracX specific
+# No point in committing the pixi.lock for gubbins as it cannot work properly within the diracx repo
+extensions/gubbins/pixi.lock

.pre-commit-config.yaml

@@ -28,6 +28,7 @@ repos:
       - id: check-yaml
         args: ["--unsafe"]
       - id: check-added-large-files
+        exclude: pixi\.lock$
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: "v0.15.7"
@@ -66,6 +67,7 @@ repos:
     hooks:
       - id: codespell
         args: ["-w"]
+        exclude: pixi\.lock$
 
   - repo: https://github.com/adamchainz/blacken-docs
     rev: 1.20.0

containers/Dockerfile

@@ -0,0 +1,62 @@
+FROM ghcr.io/prefix-dev/pixi:latest AS build
+
+ARG PIXI_ENV=container-services
+ARG DIRACX_EXTENSIONS=diracx
+
+WORKDIR /app
+COPY pixi.toml pixi.lock ./
+
+# Copy source directories needed for path-based installs
+COPY .git/ .git/
+COPY diracx-api/ diracx-api/
+COPY diracx-cli/ diracx-cli/
+COPY diracx-client/ diracx-client/
+COPY diracx-core/ diracx-core/
+COPY diracx-db/ diracx-db/
+COPY diracx-logic/ diracx-logic/
+COPY diracx-routers/ diracx-routers/
+COPY diracx-testing/ diracx-testing/
+COPY pyproject.toml ./
+COPY README.md ./
+COPY extensions/gubbins/gubbins-api/ extensions/gubbins/gubbins-api/
+COPY extensions/gubbins/gubbins-cli/ extensions/gubbins/gubbins-cli/
+COPY extensions/gubbins/gubbins-client/ extensions/gubbins/gubbins-client/
+COPY extensions/gubbins/gubbins-core/ extensions/gubbins/gubbins-core/
+COPY extensions/gubbins/gubbins-db/ extensions/gubbins/gubbins-db/
+COPY extensions/gubbins/gubbins-logic/ extensions/gubbins/gubbins-logic/
+COPY extensions/gubbins/gubbins-routers/ extensions/gubbins/gubbins-routers/
+COPY extensions/gubbins/gubbins-testing/ extensions/gubbins/gubbins-testing/
+COPY extensions/gubbins/pyproject.toml extensions/gubbins/
+COPY extensions/gubbins/README.md extensions/gubbins/
+
+# Switch to non-editable installs (same workaround as CI)
+RUN sed -i 's@editable = true@editable = false@g' pixi.toml
+
+RUN pixi install --frozen -e ${PIXI_ENV}
+
+# Generate activation script
+RUN pixi shell-hook -e ${PIXI_ENV} > /activate.sh
+
+FROM ubuntu:24.04
+
+ARG PIXI_ENV=container-services
+ARG DIRACX_EXTENSIONS=diracx
+ENV PIXI_ENV=${PIXI_ENV}
+ENV DIRACX_EXTENSIONS=${DIRACX_EXTENSIONS}
+
+EXPOSE 8000
+
+# Copy the installed environment
+COPY --from=build /app/.pixi/envs/${PIXI_ENV} /app/.pixi/envs/${PIXI_ENV}
+COPY --from=build /activate.sh /activate.sh
+COPY containers/entrypoint.sh /entrypoint.sh
+
+# In many clusters the container is run as a random uid for security reasons.
+# If we mark the environment directory as group 0 and give it group write
+# permissions then we're still able to manage the environment from inside the
+# container.
+RUN chmod -R g=u /app/.pixi
+
+# Use tini as init (installed by pixi in the env)
+ENTRYPOINT ["/bin/bash", "-c", \
+            "exec /app/.pixi/envs/${PIXI_ENV}/bin/tini -- /entrypoint.sh"]

containers/client/Dockerfile

@@ -0,0 +1,65 @@
+#!/bin/bash
+set -e
+
+source /activate.sh
+
+function install_sources() {
+    extension_name=$1
+	source_prefix=$2
+	image_packages=$3
+
+    IFS=','
+    to_install=()
+    for dir in ${!source_prefix}; do
+        for package_name in ${!image_packages}; do
+            if [[ "${package_name}" == "." ]]; then
+                wheel_name="${extension_name}"
+            else
+                wheel_name="${extension_name}_${package_name}"
+            fi
+            wheels=( $(find "${dir}" -name "${wheel_name}-*.whl") )
+            if [[ ${#wheels[@]} -gt 1 ]]; then
+                echo "ERROR: Multiple wheels found for ${package_name} in ${dir}"
+                exit 1
+            elif [[ ${#wheels[@]} -eq 1 ]]; then
+                to_install+=("${wheels[0]}")
+            else
+                if [[ "${package_name}" == "." ]]; then
+                    src_dir=("${dir}")
+                else
+                    src_dir=("${dir}-${package_name}")
+                fi
+                if [[ -f "${src_dir}/pyproject.toml" ]]; then
+                    to_install+=("${src_dir}")
+                fi
+            fi
+        done
+    done
+    if [[ ${#to_install[@]} -gt 0 ]]; then
+        pip install --no-deps "${to_install[@]}"
+    fi
+}
+
+
+# If we have extensions, we install them all the same way
+if [[ -n "${DIRACX_EXTENSIONS:-}" ]]; then
+
+	# Loop over the extension in reverse order
+	IFS=', ' read -r -a extension_array <<< "$DIRACX_EXTENSIONS"
+	for (( idx=${#extension_array[@]}-1 ; idx>=0 ; idx-- )) ; do
+
+		extension_name="${extension_array[idx]}"
+		source_prefix="${extension_name^^}_CUSTOM_SOURCE_PREFIXES"
+		image_packages="${extension_name^^}_IMAGE_PACKAGES"
+
+		if [[ -n "${!source_prefix:-}" ]]; then
+			install_sources "${extension_name}" "${source_prefix}" "${image_packages}"
+		fi
+	done
+# No extensions, just diracx
+elif [[ -n "${DIRACX_CUSTOM_SOURCE_PREFIXES:-}" ]]; then
+    install_sources "diracx" "DIRACX_CUSTOM_SOURCE_PREFIXES" "DIRACX_IMAGE_PACKAGES"
+fi
+
+
+exec "$@"

containers/entrypoint.sh

@@ -105,7 +105,7 @@ def instrument_otel(app: FastAPI) -> None:
     # # override logger format which with trace id and span id
     # https://github.com/mhausenblas/ref.otel.help/blob/main/how-to/logs-collection/yoda/main.py
 
-    LoggingInstrumentor().instrument(set_logging_format=False)
+    LoggingInstrumentor().instrument(set_logging_format=True)
 
     logger_provider = LoggerProvider(resource=resource)
     _logs.set_logger_provider(logger_provider)